CVE-2026-16595: WP Directory Kit Information Disclosure

CVE-2026-16595 Overview

CVE-2026-16595 is a broken access control vulnerability in the WP Directory Kit WordPress plugin before version 1.5.5. The plugin fails to perform authorization and nonce checks on one of its authenticated AJAX actions. Any authenticated user, including low-privilege Subscribers, can invoke the action to disclose the site's user list and unpublished listings owned by other users. The flaw maps to CWE-200: Exposure of Sensitive Information to an Unauthorized Actor. Exploitation requires only a valid low-privilege account, which is trivial on sites that permit open user registration.

Critical Impact
Authenticated Subscriber-level users can enumerate all site users and access unpublished listings belonging to other accounts.

Affected Products

WP Directory Kit WordPress plugin versions prior to 1.5.5

Discovery Timeline

2026-08-08 - CVE-2026-16595 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-16595

Vulnerability Analysis

WP Directory Kit registers an AJAX action accessible through the wp-admin/admin-ajax.php endpoint. WordPress AJAX actions prefixed with wp_ajax_ are available to any user with a valid session cookie. The vulnerable action does not verify the caller's capability with current_user_can() and does not validate a request nonce with check_ajax_referer(). As a result, the handler treats every authenticated request as legitimate regardless of role.

When invoked, the action returns two sensitive datasets. The first is the site's user list, which normally requires the list_users capability held only by Administrators. The second is unpublished directory listings, including drafts and pending entries owned by other users. Both datasets bypass the standard WordPress visibility rules.

The issue affects confidentiality only; integrity and availability are not directly impacted. Sites that allow open registration face the highest exposure because attackers can self-provision the Subscriber accounts needed to reach the endpoint.

Root Cause

The root cause is missing authorization enforcement on a privileged AJAX handler. The plugin developer registered the action under the authenticated hook without adding capability checks or nonce validation. This pattern is a common WordPress plugin defect where developers assume authentication implies authorization.

Attack Vector

An attacker with any authenticated account sends a crafted POST request to admin-ajax.php specifying the vulnerable action name. The server responds with JSON containing the user list and unpublished listings. No user interaction or elevated privileges are required beyond initial authentication. Refer to the WPScan Vulnerability Report for exploitation specifics.

Detection Methods for CVE-2026-16595

Indicators of Compromise

Anomalous POST requests to /wp-admin/admin-ajax.php originating from Subscriber-level accounts.
Unusually large JSON responses returned by admin-ajax.php to non-administrative users.
Spikes in new user registrations followed shortly by AJAX activity from those accounts.

Detection Strategies

Inspect web server access logs for repeated admin-ajax.php calls referencing WP Directory Kit action names from low-privilege sessions.
Correlate WordPress authentication events with AJAX endpoint usage to identify Subscribers accessing administrator-scoped data.
Deploy WordPress security plugins or a web application firewall (WAF) rule set to log calls to the affected action.

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and forward logs to a centralized SIEM for correlation.
Alert on any account transitioning from registration to admin-ajax.php invocation within a short time window.
Monitor for exfiltration patterns such as sequential enumeration of user IDs or listing IDs.

How to Mitigate CVE-2026-16595

Immediate Actions Required

Upgrade WP Directory Kit to version 1.5.5 or later on all affected WordPress sites.
Audit existing user accounts and remove unrecognized Subscriber registrations created before the patch.
Review recent admin-ajax.php traffic for signs of data enumeration by low-privilege users.

Patch Information

The vendor addressed CVE-2026-16595 in WP Directory Kit version 1.5.5 by adding authorization and nonce checks to the affected AJAX action. Details are documented in the WPScan Vulnerability Report.

Workarounds

Disable open user registration by unchecking Anyone can register under Settings > General until the plugin is updated.
Deploy a WAF rule to block requests to admin-ajax.php targeting the vulnerable action from non-administrator sessions.
Temporarily deactivate the WP Directory Kit plugin if upgrading is not immediately possible.

bash

# Example WAF rule to block the vulnerable AJAX action for non-admins
# Adjust action name per WPScan advisory before deployment
SecRule REQUEST_URI "@contains /wp-admin/admin-ajax.php" \
    "chain,deny,status:403,id:1026016595,msg:'Block WP Directory Kit CVE-2026-16595'"
    SecRule ARGS:action "@rx ^wpdk_[a-z_]+$"